@hexclave/js 1.0.20 → 1.0.22

package/dist/lib/hexclave-app/apps/implementations/session-replay.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-replay.test.js","names":["SessionRecorder","Result","vi"],"sources":["../../../../../src/lib/hexclave-app/apps/implementations/session-replay.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\n// @vitest-environment jsdom\n\nimport { describe, expect, it, vi } from \"vitest\";\nimport { Result } from \"@hexclave/shared/dist/utils/results\";\nimport { analyticsOptionsFromJson, analyticsOptionsToJson, getSessionReplayOptions, SessionRecorder } from \"./session-replay\";\n\ndescribe(\"session replay options\", () => {\n  it(\"enables replays by default\", () => {\n    expect(getSessionReplayOptions(undefined).enabled).toBe(true);\n    expect(getSessionReplayOptions({}).enabled).toBe(true);\n    expect(getSessionReplayOptions({ replays: {} }).enabled).toBe(true);\n  });\n\n  it(\"preserves explicit replay opt-out\", () => {\n    expect(getSessionReplayOptions({ replays: { enabled: false } }).enabled).toBe(false);\n  });\n});\n\ndescribe(\"analytics option JSON conversion\", () => {\n  it(\"preserves top-level analytics options when serializing replay block classes\", () => {\n    const json = analyticsOptionsToJson({\n      enabled: false,\n      replays: {\n        enabled: true,\n        blockClass: /stack-sensitive/u,\n      },\n    });\n\n    expect(json?.enabled).toBe(false);\n    expect(json?.replays?.enabled).toBe(true);\n  });\n\n  it(\"preserves top-level analytics options when deserializing replay block classes\", () => {\n    const roundTripped = analyticsOptionsFromJson(analyticsOptionsToJson({\n      enabled: false,\n      replays: {\n        blockClass: /stack-sensitive/u,\n      },\n    }));\n\n    expect(roundTripped?.enabled).toBe(false);\n    expect(roundTripped?.replays?.blockClass).toEqual(/stack-sensitive/u);\n  });\n});\n\ndescribe(\"SessionRecorder flush\", () => {\n  it(\"silently disables when server responds with ANALYTICS_NOT_ENABLED\", async () => {\n    vi.useFakeTimers();\n\n    // Seed localStorage with a valid session so _flush doesn't fail on getOrRotateSession\n    const storageKey = `hexclave:session-replay:v1:test-project`;\n    localStorage.setItem(storageKey, JSON.stringify({\n      session_id: \"test-session\",\n      created_at_ms: Date.now(),\n      last_activity_ms: Date.now(),\n    }));\n\n    const sentBodies: string[] = [];\n    const recorder = new SessionRecorder(\n      {\n        projectId: \"test-project\",\n        sendBatch: async (body) => {\n          sentBodies.push(body);\n          return Result.ok(new Response(\n            JSON.stringify({ code: \"ANALYTICS_NOT_ENABLED\", error: \"Analytics is not enabled for this project.\" }),\n            {\n              status: 400,\n              headers: { \"x-stack-known-error\": \"ANALYTICS_NOT_ENABLED\" },\n            },\n          ));\n        },\n      },\n      {},\n    );\n\n    const warnSpy = vi.spyOn(console, \"warn\").mockImplementation(() => {});\n\n    try {\n      // Inject an event directly into the recorder's buffer to test flush behavior\n      // without needing rrweb. We access private fields for testing purposes.\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access\n      (recorder as any)._events = [{ type: 2, timestamp: Date.now(), data: {} }];\n\n      // Manually trigger a tick (which calls _flush)\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call\n      (recorder as any)._tick();\n      await vi.advanceTimersByTimeAsync(0);\n\n      // One batch should have been sent\n      expect(sentBodies).toHaveLength(1);\n\n      // No console.warn about \"SessionRecorder flush failed\" should have been emitted\n      const flushWarnings = warnSpy.mock.calls.filter(\n        (args) => typeof args[0] === \"string\" && args[0].includes(\"SessionRecorder\")\n      );\n      expect(flushWarnings).toHaveLength(0);\n\n      // After disabling, pushing new events and triggering another tick should not send\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access\n      (recorder as any)._events = [{ type: 3, timestamp: Date.now(), data: {} }];\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call\n      (recorder as any)._tick();\n      await vi.advanceTimersByTimeAsync(0);\n      expect(sentBodies).toHaveLength(1);\n    } finally {\n      recorder.stop();\n      warnSpy.mockRestore();\n      localStorage.removeItem(storageKey);\n      vi.useRealTimers();\n    }\n  });\n});\n"],"mappings":";;;;;;;qBAUS,gCAAgC;AACvC,gBAAG,oCAAoC;AACrC,sEAA+B,OAAU,CAAC,QAAQ,CAAC,KAAK,KAAK;AAC7D,sEAA+B,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,KAAK;AACtD,sEAA+B,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,KAAK;GACnE;AAEF,gBAAG,2CAA2C;AAC5C,sEAA+B,EAAE,SAAS,EAAE,SAAS,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,MAAM;GACpF;EACF;qBAEO,0CAA0C;AACjD,gBAAG,qFAAqF;EACtF,MAAM,uDAA8B;GAClC,SAAS;GACT,SAAS;IACP,SAAS;IACT,YAAY;IACb;GACF,CAAC;AAEF,qBAAO,MAAM,QAAQ,CAAC,KAAK,MAAM;AACjC,qBAAO,MAAM,SAAS,QAAQ,CAAC,KAAK,KAAK;GACzC;AAEF,gBAAG,uFAAuF;EACxF,MAAM,iHAA+D;GACnE,SAAS;GACT,SAAS,EACP,YAAY,oBACb;GACF,CAAC,CAAC;AAEH,qBAAO,cAAc,QAAQ,CAAC,KAAK,MAAM;AACzC,qBAAO,cAAc,SAAS,WAAW,CAAC,QAAQ,mBAAmB;GACrE;EACF;qBAEO,+BAA+B;AACtC,gBAAG,qEAAqE,YAAY;AAClF,YAAG,eAAe;EAGlB,MAAM,aAAa;AACnB,eAAa,QAAQ,YAAY,KAAK,UAAU;GAC9C,YAAY;GACZ,eAAe,KAAK,KAAK;GACzB,kBAAkB,KAAK,KAAK;GAC7B,CAAC,CAAC;EAEH,MAAM,aAAuB,EAAE;EAC/B,MAAM,WAAW,IAAIA,oCACnB;GACE,WAAW;GACX,WAAW,OAAO,SAAS;AACzB,eAAW,KAAK,KAAK;AACrB,WAAOC,2CAAO,GAAG,IAAI,SACnB,KAAK,UAAU;KAAE,MAAM;KAAyB,OAAO;KAA8C,CAAC,EACtG;KACE,QAAQ;KACR,SAAS,EAAE,uBAAuB,yBAAyB;KAC5D,CACF,CAAC;;GAEL,EACD,EAAE,CACH;EAED,MAAM,UAAUC,UAAG,MAAM,SAAS,OAAO,CAAC,yBAAyB,GAAG;AAEtE,MAAI;AAIF,GAAC,SAAiB,UAAU,CAAC;IAAE,MAAM;IAAG,WAAW,KAAK,KAAK;IAAE,MAAM,EAAE;IAAE,CAAC;AAI1E,GAAC,SAAiB,OAAO;AACzB,SAAMA,UAAG,yBAAyB,EAAE;AAGpC,sBAAO,WAAW,CAAC,aAAa,EAAE;AAMlC,sBAHsB,QAAQ,KAAK,MAAM,QACtC,SAAS,OAAO,KAAK,OAAO,YAAY,KAAK,GAAG,SAAS,kBAAkB,CAC7E,CACoB,CAAC,aAAa,EAAE;AAIrC,GAAC,SAAiB,UAAU,CAAC;IAAE,MAAM;IAAG,WAAW,KAAK,KAAK;IAAE,MAAM,EAAE;IAAE,CAAC;AAE1E,GAAC,SAAiB,OAAO;AACzB,SAAMA,UAAG,yBAAyB,EAAE;AACpC,sBAAO,WAAW,CAAC,aAAa,EAAE;YAC1B;AACR,YAAS,MAAM;AACf,WAAQ,aAAa;AACrB,gBAAa,WAAW,WAAW;AACnC,aAAG,eAAe;;GAEpB;EACF"}
+{"version":3,"file":"session-replay.test.js","names":["SessionRecorder","Result","KnownErrors","vi"],"sources":["../../../../../src/lib/hexclave-app/apps/implementations/session-replay.test.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\n// @vitest-environment jsdom\n\nimport { KnownErrors } from \"@hexclave/shared/dist/known-errors\";\nimport { describe, expect, it, vi } from \"vitest\";\nimport { Result } from \"@hexclave/shared/dist/utils/results\";\nimport { analyticsOptionsFromJson, analyticsOptionsToJson, getSessionReplayOptions, SessionRecorder } from \"./session-replay\";\n\ndescribe(\"session replay options\", () => {\n  it(\"enables replays by default\", () => {\n    expect(getSessionReplayOptions(undefined).enabled).toBe(true);\n    expect(getSessionReplayOptions({}).enabled).toBe(true);\n    expect(getSessionReplayOptions({ replays: {} }).enabled).toBe(true);\n  });\n\n  it(\"preserves explicit replay opt-out\", () => {\n    expect(getSessionReplayOptions({ replays: { enabled: false } }).enabled).toBe(false);\n  });\n});\n\ndescribe(\"analytics option JSON conversion\", () => {\n  it(\"preserves top-level analytics options when serializing replay block classes\", () => {\n    const json = analyticsOptionsToJson({\n      enabled: false,\n      replays: {\n        enabled: true,\n        blockClass: /stack-sensitive/u,\n      },\n    });\n\n    expect(json?.enabled).toBe(false);\n    expect(json?.replays?.enabled).toBe(true);\n  });\n\n  it(\"preserves top-level analytics options when deserializing replay block classes\", () => {\n    const roundTripped = analyticsOptionsFromJson(analyticsOptionsToJson({\n      enabled: false,\n      replays: {\n        blockClass: /stack-sensitive/u,\n      },\n    }));\n\n    expect(roundTripped?.enabled).toBe(false);\n    expect(roundTripped?.replays?.blockClass).toEqual(/stack-sensitive/u);\n  });\n});\n\ndescribe(\"SessionRecorder flush\", () => {\n  it(\"silently disables when client interface returns ANALYTICS_NOT_ENABLED as an error\", async () => {\n    vi.useFakeTimers();\n\n    const storageKey = `hexclave:session-replay:v1:test-project`;\n    localStorage.setItem(storageKey, JSON.stringify({\n      session_id: \"test-session\",\n      created_at_ms: Date.now(),\n      last_activity_ms: Date.now(),\n    }));\n\n    const sentBodies: string[] = [];\n    const recorder = new SessionRecorder(\n      {\n        projectId: \"test-project\",\n        sendBatch: async (body) => {\n          sentBodies.push(body);\n          return Result.error(new KnownErrors.AnalyticsNotEnabled());\n        },\n      },\n      {},\n    );\n\n    const warnSpy = vi.spyOn(console, \"warn\").mockImplementation(() => {});\n\n    try {\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access\n      (recorder as any)._events = [{ type: 2, timestamp: Date.now(), data: {} }];\n\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call\n      (recorder as any)._tick();\n      await vi.advanceTimersByTimeAsync(0);\n\n      expect(sentBodies).toHaveLength(1);\n      expect(warnSpy).not.toHaveBeenCalled();\n\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access\n      (recorder as any)._events = [{ type: 3, timestamp: Date.now(), data: {} }];\n      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call\n      (recorder as any)._tick();\n      await vi.advanceTimersByTimeAsync(0);\n      expect(sentBodies).toHaveLength(1);\n    } finally {\n      recorder.stop();\n      warnSpy.mockRestore();\n      localStorage.removeItem(storageKey);\n      vi.useRealTimers();\n    }\n  });\n});\n"],"mappings":";;;;;;;;qBAWS,gCAAgC;AACvC,gBAAG,oCAAoC;AACrC,sEAA+B,OAAU,CAAC,QAAQ,CAAC,KAAK,KAAK;AAC7D,sEAA+B,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,KAAK;AACtD,sEAA+B,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,KAAK;GACnE;AAEF,gBAAG,2CAA2C;AAC5C,sEAA+B,EAAE,SAAS,EAAE,SAAS,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,MAAM;GACpF;EACF;qBAEO,0CAA0C;AACjD,gBAAG,qFAAqF;EACtF,MAAM,uDAA8B;GAClC,SAAS;GACT,SAAS;IACP,SAAS;IACT,YAAY;IACb;GACF,CAAC;AAEF,qBAAO,MAAM,QAAQ,CAAC,KAAK,MAAM;AACjC,qBAAO,MAAM,SAAS,QAAQ,CAAC,KAAK,KAAK;GACzC;AAEF,gBAAG,uFAAuF;EACxF,MAAM,iHAA+D;GACnE,SAAS;GACT,SAAS,EACP,YAAY,oBACb;GACF,CAAC,CAAC;AAEH,qBAAO,cAAc,QAAQ,CAAC,KAAK,MAAM;AACzC,qBAAO,cAAc,SAAS,WAAW,CAAC,QAAQ,mBAAmB;GACrE;EACF;qBAEO,+BAA+B;AACtC,gBAAG,qFAAqF,YAAY;AAClG,YAAG,eAAe;EAElB,MAAM,aAAa;AACnB,eAAa,QAAQ,YAAY,KAAK,UAAU;GAC9C,YAAY;GACZ,eAAe,KAAK,KAAK;GACzB,kBAAkB,KAAK,KAAK;GAC7B,CAAC,CAAC;EAEH,MAAM,aAAuB,EAAE;EAC/B,MAAM,WAAW,IAAIA,oCACnB;GACE,WAAW;GACX,WAAW,OAAO,SAAS;AACzB,eAAW,KAAK,KAAK;AACrB,WAAOC,2CAAO,MAAM,IAAIC,+CAAY,qBAAqB,CAAC;;GAE7D,EACD,EAAE,CACH;EAED,MAAM,UAAUC,UAAG,MAAM,SAAS,OAAO,CAAC,yBAAyB,GAAG;AAEtE,MAAI;AAEF,GAAC,SAAiB,UAAU,CAAC;IAAE,MAAM;IAAG,WAAW,KAAK,KAAK;IAAE,MAAM,EAAE;IAAE,CAAC;AAG1E,GAAC,SAAiB,OAAO;AACzB,SAAMA,UAAG,yBAAyB,EAAE;AAEpC,sBAAO,WAAW,CAAC,aAAa,EAAE;AAClC,sBAAO,QAAQ,CAAC,IAAI,kBAAkB;AAGtC,GAAC,SAAiB,UAAU,CAAC;IAAE,MAAM;IAAG,WAAW,KAAK,KAAK;IAAE,MAAM,EAAE;IAAE,CAAC;AAE1E,GAAC,SAAiB,OAAO;AACzB,SAAMA,UAAG,yBAAyB,EAAE;AACpC,sBAAO,WAAW,CAAC,aAAa,EAAE;YAC1B;AACR,YAAS,MAAM;AACf,WAAQ,aAAa;AACrB,gBAAa,WAAW,WAAW;AACnC,aAAG,eAAe;;GAEpB;EACF"}

package/dist/lib/hexclave-app/apps/interfaces/admin-app.d.ts

@@ -17,6 +17,7 @@ import { MoneyAmount } from "@hexclave/shared/dist/utils/currency-constants";
 type EmailOutboxListOptions = {
   status?: string;
   simpleStatus?: string;
+  userId?: string;
   limit?: number;
   cursor?: string;
 };

package/dist/lib/hexclave-app/apps/interfaces/admin-app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-app.d.ts","names":[],"sources":["../../../../../src/lib/hexclave-app/apps/interfaces/admin-app.ts"],"mappings":";;;;;;;;;;;;;;;;KAmBY,sBAAA;EACV,MAAA;EACA,YAAA;EACA,KAAA;EACA,MAAA;AAAA;AAAA,KAGU,qBAAA;EACV,KAAA,EAAO,gBAAA;EACP,UAAA;AAAA;AAAA,KAGU,wBAAA;EACV,QAAA;EACA,iBAAA;EACA,MAAA;EACA,SAAA;EACA,OAAA;AAAA;AAAA,KAGU,+BAAA;EACV,QAAA;EACA,SAAA;EACA,eAAA;EACA,iBAAA;EACA,MAAA,EAAQ,0BAAA;AAAA;AAAA,KAGE,0BAAA;EACV,MAAA;AAAA;AAAA,KAGU,4BAAA;EACV,QAAA;EACA,SAAA;EACA,eAAA;EACA,MAAA,EAAQ,0BAAA;EACR,iBAAA;AAAA;;KAQU,+BAAA,6DACR,gCAAA,CAAiC,aAAA,EAAe,SAAA;EAEhD,mBAAA;EACA,mBAAA,GAAsB,eAAA,UAAyB,OAAA;AAAA;;KAMvC,aAAA,gFACR,kBAAA,gBAAkC,YAAA,WAClC,kBAAA,wBAA0C,cAAA,YAC1C,kBAAA,kCAAoD,6BAAA,YACpD,kBAAA,qCAAuD,gCAAA,YACvD,kBAAA;EAAwC,EAAA;EAAY,WAAA;AAAA,aACpD,kBAAA;EAAsC,OAAA;EAAiC,cAAA;EAAyB,UAAA;EAAqB,iBAAA;AAAA,qBACrH,kBAAA;EAA2C,EAAA;EAAY,WAAA;EAAqB,OAAA;EAAkB,SAAA;AAAA,aAC9F,kBAAA;EAAwC,EAAA;EAAY,WAAA;EAAqB,OAAA;EAAqC,SAAA;EAAmB,MAAA,EAAQ,IAAA;AAAA,aACzI,kBAAA;EAA8C,UAAA;EAAoB,eAAA;EAA0B,iBAAA;EAA4B,eAAA;AAAA,mBACxH,kBAAA;EAGE,MAAA;EACA,KAAA;EACA,IAAA,GAAO,eAAA;EACP,YAAA;EACA,UAAA;AAAA;EAEA,YAAA,EAAc,WAAA;EAAe,UAAA;AAAA;EAI/B,oBAAA,CAAqB,OAAA,EAAS,2BAAA,GAA8B,OAAA,CAAQ,uBAAA;EAEpE,8BAAA,CAA+B,IAAA,EAAM,0CAAA,GAA6C,OAAA,CAAQ,mBAAA;EAC1F,8BAAA,CAA+B,YAAA,UAAsB,IAAA,EAAM,0CAAA,GAA6C,OAAA;EACxG,8BAAA,CAA+B,YAAA,WAAuB,OAAA;EAjCA;AAM1D;;EA+BI,sCAAA,CAAuC,OAAA;IAAW,KAAA;IAAe,MAAA;IAAiB,KAAA;EAAA,IAAmB,OAAA;IAAU,KAAA,EAAO,6BAAA;IAAiC,UAAA;EAAA;EAEvJ,iCAAA,CAAkC,IAAA,EAAM,6CAAA,GAAgD,OAAA,CAAQ,sBAAA;EAChG,iCAAA,CAAkC,YAAA,UAAsB,IAAA,EAAM,6CAAA,GAAgD,OAAA;EAC9G,iCAAA,CAAkC,YAAA,WAAuB,OAAA;EAGzD,aAAA,CAAc,OAAA;IACZ,cAAA;IACA,WAAA,EAAa,WAAA;EAAA,IACX,OAAA,CAAQ,MAAA;IAAoB,YAAA;EAAA;EAEhC,eAAA,CAAgB,OAAA;IAAW,UAAA;EAAA,IAAuB,OAAA,CAAQ,MAAA;IAAoB,YAAA;EAAA;EAE9E,yBAAA,CAA0B,KAAA,UAAe,WAAA,WAAsB,OAAA;EAE/D,cAAA,IAAkB,OAAA,CAAQ,cAAA;EAC1B,yBAAA,CAA0B,OAAA;IAAW,SAAA;IAAmB,eAAA;EAAA,IAA4B,OAAA,CAAQ,+BAAA;EAC5F,uBAAA,CAAwB,OAAA;IAAW,QAAA;IAAkB,SAAA;IAAmB,eAAA;EAAA,IAA4B,OAAA,CAAQ,0BAAA;EAC5G,uBAAA,IAA2B,OAAA,CAAQ,4BAAA;EACnC,yBAAA,CAA0B,OAAA;IAAW,QAAA;EAAA,IAAqB,OAAA;IAAU,MAAA;EAAA;EACpE,wBAAA,CAAyB,OAAA;IAAW,cAAA;EAAA,IAA2B,OAAA;IAAU,MAAA;EAAA;EAEzE,gBAAA,CAAiB,WAAA,WAAsB,OAAA;IAAU,EAAA;EAAA;EACjD,gBAAA,CAAiB,EAAA,UAAY,SAAA,WAAoB,OAAA;EACjD,gBAAA,CAAiB,EAAA,WAAa,OAAA;EAC9B,eAAA,CAAgB,QAAA,UAAkB,OAAA,QAAe,OAAA;EACjD,gBAAA,CAAiB,QAAA,WAAmB,OAAA;IAAU,QAAA,EAAU,KAAA;EAAA;EACxD,2BAAA,CAA4B,iBAAA,WAA4B,OAAA;IAAU,SAAA;EAAA;EAClE,mBAAA,CAAoB,EAAA,UAAY,SAAA,UAAmB,OAAA,0BAAiC,OAAA;IAAU,YAAA;EAAA;EAC9F,mBAAA,CAAoB,WAAA,WAAsB,OAAA;IAAU,EAAA;EAAA;EACpD,mBAAA,CAAoB,EAAA,WAAa,OAAA;EAEjC,aAAA,IAAiB,OAAA;IAAU,GAAA;EAAA;EAC3B,gCAAA,IAAoC,OAAA;IAAU,aAAA;EAAA;EAC9C,uBAAA,IAA2B,OAAA;IAAU,QAAA;IAAkB,OAAA,EAAS,KAAA;MAAQ,EAAA;MAAY,IAAA;MAAc,OAAA;MAAkB,SAAA;MAAoB,WAAA;IAAA;EAAA;EACxI,0BAAA,CAA2B,QAAA,UAAkB,OAAA,EAAS,MAAA,yBAA+B,OAAA;EACrF,gBAAA,CAAiB,OAAA;IAAW,WAAA;IAAqB,OAAA;IAAsC,SAAA;EAAA,IAAuB,OAAA;IAAU,EAAA;EAAA;EACxH,gBAAA,CAAiB,EAAA,UAAY,IAAA;IAAQ,WAAA;IAAsB,OAAA;IAAsC,SAAA;EAAA,IAAuB,OAAA;EACxH,gBAAA,CAAiB,EAAA,WAAa,OAAA;EAC9B,kBAAA,IAAsB,OAAA;EACtB,wBAAA,CAAyB,OAAA;IACrB,MAAA;IAAgB,MAAA;IAAgB,QAAA;IAAkB,SAAA;IAAoB,WAAA;EAAA;IACtE,MAAA;IAAgB,MAAA;IAAgB,QAAA;IAAkB,SAAA;IAAoB,WAAA;EAAA;IACtE,gBAAA;IAA0B,MAAA;IAAgB,QAAA;IAAkB,SAAA;IAAoB,WAAA;EAAA,KAChF,OAAA;EACJ,iBAAA,CAAkB,OAAA;IAChB,IAAA;IACA,EAAA;IACA,SAAA;IACA,SAAA,EAAW,WAAA;IACX,SAAA;EAAA,IACE,OAAA;IAAU,mBAAA;EAAA;EACd,cAAA,CAAe,OAAA,EAAS,qBAAA,GAAwB,OAAA,CAAQ,sBAAA;EACxD,oBAAA,CAAqB,OAAA,EAAS,wBAAA,GAA2B,OAAA,CAAQ,yBAAA;EACjE,4BAAA,CAA6B,OAAA;IAAW,MAAA;EAAA,IAAmB,OAAA,CAAQ,8BAAA;EAEnE,kBAAA,CAAmB,OAAA,GAAU,yBAAA,GAA4B,OAAA,CAAQ,wBAAA;EACjE,gBAAA,CAAiB,eAAA,WAA0B,OAAA,CAAQ,kBAAA;EACnD,uBAAA,CAAwB,eAAA,UAAyB,OAAA,GAAU,8BAAA,GAAiC,OAAA,CAAQ,6BAAA;EACpG,2BAAA,CAA4B,eAAA,UAAyB,OAAA,WAAkB,OAAA,CAAQ,wCAAA;EAC/E,sBAAA,CAAuB,eAAA,UAAyB,OAAA;IAAY,MAAA;IAAiB,KAAA;EAAA,IAAmB,OAAA,CAAQ,4BAAA;EAGxG,gBAAA,CAAiB,OAAA,GAAU,sBAAA,GAAyB,OAAA,CAAQ,qBAAA;EAC5D,cAAA,CAAe,EAAA,WAAa,OAAA,CAAQ,gBAAA;EACpC,iBAAA,CAAkB,EAAA,UAAY,OAAA,EAAS,wBAAA,GAA2B,OAAA,CAAQ,gBAAA;EAC1E,gBAAA,CAAiB,EAAA,WAAa,OAAA,CAAQ,gBAAA;EACtC,kBAAA,CAAmB,EAAA,WAAa,OAAA,CAAQ,gBAAA;EACxC,iBAAA,CAAkB,EAAA,WAAa,OAAA,CAAQ,gBAAA;AAAA,IAEvC,cAAA,CAAe,aAAA,EAAe,SAAA;;KAGtB,wBAAA;EAAA,8DAIR,OAAA,EAAS,+BAAA,CAAgC,aAAA,EAAe,SAAA,IAAa,aAAA,CAAc,aAAA,EAAe,SAAA;EAAA,KAChG,OAAA,EAAS,+BAAA,oBAAmD,aAAA;AAAA;AAAA,KAEtD,kCAAA,4DAA8F,+BAAA,CAAgC,aAAA,EAAe,SAAA;AAAA,KAC7I,gBAAA,+EAA+F,aAAA,CAAc,aAAA,EAAe,SAAA;AAAA,KAC5H,2BAAA,GAA8B,wBAAA;AAAA,cAC7B,gBAAA,EAAkB,2BAAA;;cAElB,aAAA,EAAe,wBAAA"}
+{"version":3,"file":"admin-app.d.ts","names":[],"sources":["../../../../../src/lib/hexclave-app/apps/interfaces/admin-app.ts"],"mappings":";;;;;;;;;;;;;;;;KAmBY,sBAAA;EACV,MAAA;EACA,YAAA;EACA,MAAA;EACA,KAAA;EACA,MAAA;AAAA;AAAA,KAGU,qBAAA;EACV,KAAA,EAAO,gBAAA;EACP,UAAA;AAAA;AAAA,KAGU,wBAAA;EACV,QAAA;EACA,iBAAA;EACA,MAAA;EACA,SAAA;EACA,OAAA;AAAA;AAAA,KAGU,+BAAA;EACV,QAAA;EACA,SAAA;EACA,eAAA;EACA,iBAAA;EACA,MAAA,EAAQ,0BAAA;AAAA;AAAA,KAGE,0BAAA;EACV,MAAA;AAAA;AAAA,KAGU,4BAAA;EACV,QAAA;EACA,SAAA;EACA,eAAA;EACA,MAAA,EAAQ,0BAAA;EACR,iBAAA;AAAA;;KAQU,+BAAA,6DACR,gCAAA,CAAiC,aAAA,EAAe,SAAA;EAEhD,mBAAA;EACA,mBAAA,GAAsB,eAAA,UAAyB,OAAA;AAAA;;KAMvC,aAAA,gFACR,kBAAA,gBAAkC,YAAA,WAClC,kBAAA,wBAA0C,cAAA,YAC1C,kBAAA,kCAAoD,6BAAA,YACpD,kBAAA,qCAAuD,gCAAA,YACvD,kBAAA;EAAwC,EAAA;EAAY,WAAA;AAAA,aACpD,kBAAA;EAAsC,OAAA;EAAiC,cAAA;EAAyB,UAAA;EAAqB,iBAAA;AAAA,qBACrH,kBAAA;EAA2C,EAAA;EAAY,WAAA;EAAqB,OAAA;EAAkB,SAAA;AAAA,aAC9F,kBAAA;EAAwC,EAAA;EAAY,WAAA;EAAqB,OAAA;EAAqC,SAAA;EAAmB,MAAA,EAAQ,IAAA;AAAA,aACzI,kBAAA;EAA8C,UAAA;EAAoB,eAAA;EAA0B,iBAAA;EAA4B,eAAA;AAAA,mBACxH,kBAAA;EAGE,MAAA;EACA,KAAA;EACA,IAAA,GAAO,eAAA;EACP,YAAA;EACA,UAAA;AAAA;EAEA,YAAA,EAAc,WAAA;EAAe,UAAA;AAAA;EAI/B,oBAAA,CAAqB,OAAA,EAAS,2BAAA,GAA8B,OAAA,CAAQ,uBAAA;EAEpE,8BAAA,CAA+B,IAAA,EAAM,0CAAA,GAA6C,OAAA,CAAQ,mBAAA;EAC1F,8BAAA,CAA+B,YAAA,UAAsB,IAAA,EAAM,0CAAA,GAA6C,OAAA;EACxG,8BAAA,CAA+B,YAAA,WAAuB,OAAA;EAjCA;AAM1D;;EA+BI,sCAAA,CAAuC,OAAA;IAAW,KAAA;IAAe,MAAA;IAAiB,KAAA;EAAA,IAAmB,OAAA;IAAU,KAAA,EAAO,6BAAA;IAAiC,UAAA;EAAA;EAEvJ,iCAAA,CAAkC,IAAA,EAAM,6CAAA,GAAgD,OAAA,CAAQ,sBAAA;EAChG,iCAAA,CAAkC,YAAA,UAAsB,IAAA,EAAM,6CAAA,GAAgD,OAAA;EAC9G,iCAAA,CAAkC,YAAA,WAAuB,OAAA;EAGzD,aAAA,CAAc,OAAA;IACZ,cAAA;IACA,WAAA,EAAa,WAAA;EAAA,IACX,OAAA,CAAQ,MAAA;IAAoB,YAAA;EAAA;EAEhC,eAAA,CAAgB,OAAA;IAAW,UAAA;EAAA,IAAuB,OAAA,CAAQ,MAAA;IAAoB,YAAA;EAAA;EAE9E,yBAAA,CAA0B,KAAA,UAAe,WAAA,WAAsB,OAAA;EAE/D,cAAA,IAAkB,OAAA,CAAQ,cAAA;EAC1B,yBAAA,CAA0B,OAAA;IAAW,SAAA;IAAmB,eAAA;EAAA,IAA4B,OAAA,CAAQ,+BAAA;EAC5F,uBAAA,CAAwB,OAAA;IAAW,QAAA;IAAkB,SAAA;IAAmB,eAAA;EAAA,IAA4B,OAAA,CAAQ,0BAAA;EAC5G,uBAAA,IAA2B,OAAA,CAAQ,4BAAA;EACnC,yBAAA,CAA0B,OAAA;IAAW,QAAA;EAAA,IAAqB,OAAA;IAAU,MAAA;EAAA;EACpE,wBAAA,CAAyB,OAAA;IAAW,cAAA;EAAA,IAA2B,OAAA;IAAU,MAAA;EAAA;EAEzE,gBAAA,CAAiB,WAAA,WAAsB,OAAA;IAAU,EAAA;EAAA;EACjD,gBAAA,CAAiB,EAAA,UAAY,SAAA,WAAoB,OAAA;EACjD,gBAAA,CAAiB,EAAA,WAAa,OAAA;EAC9B,eAAA,CAAgB,QAAA,UAAkB,OAAA,QAAe,OAAA;EACjD,gBAAA,CAAiB,QAAA,WAAmB,OAAA;IAAU,QAAA,EAAU,KAAA;EAAA;EACxD,2BAAA,CAA4B,iBAAA,WAA4B,OAAA;IAAU,SAAA;EAAA;EAClE,mBAAA,CAAoB,EAAA,UAAY,SAAA,UAAmB,OAAA,0BAAiC,OAAA;IAAU,YAAA;EAAA;EAC9F,mBAAA,CAAoB,WAAA,WAAsB,OAAA;IAAU,EAAA;EAAA;EACpD,mBAAA,CAAoB,EAAA,WAAa,OAAA;EAEjC,aAAA,IAAiB,OAAA;IAAU,GAAA;EAAA;EAC3B,gCAAA,IAAoC,OAAA;IAAU,aAAA;EAAA;EAC9C,uBAAA,IAA2B,OAAA;IAAU,QAAA;IAAkB,OAAA,EAAS,KAAA;MAAQ,EAAA;MAAY,IAAA;MAAc,OAAA;MAAkB,SAAA;MAAoB,WAAA;IAAA;EAAA;EACxI,0BAAA,CAA2B,QAAA,UAAkB,OAAA,EAAS,MAAA,yBAA+B,OAAA;EACrF,gBAAA,CAAiB,OAAA;IAAW,WAAA;IAAqB,OAAA;IAAsC,SAAA;EAAA,IAAuB,OAAA;IAAU,EAAA;EAAA;EACxH,gBAAA,CAAiB,EAAA,UAAY,IAAA;IAAQ,WAAA;IAAsB,OAAA;IAAsC,SAAA;EAAA,IAAuB,OAAA;EACxH,gBAAA,CAAiB,EAAA,WAAa,OAAA;EAC9B,kBAAA,IAAsB,OAAA;EACtB,wBAAA,CAAyB,OAAA;IACrB,MAAA;IAAgB,MAAA;IAAgB,QAAA;IAAkB,SAAA;IAAoB,WAAA;EAAA;IACtE,MAAA;IAAgB,MAAA;IAAgB,QAAA;IAAkB,SAAA;IAAoB,WAAA;EAAA;IACtE,gBAAA;IAA0B,MAAA;IAAgB,QAAA;IAAkB,SAAA;IAAoB,WAAA;EAAA,KAChF,OAAA;EACJ,iBAAA,CAAkB,OAAA;IAChB,IAAA;IACA,EAAA;IACA,SAAA;IACA,SAAA,EAAW,WAAA;IACX,SAAA;EAAA,IACE,OAAA;IAAU,mBAAA;EAAA;EACd,cAAA,CAAe,OAAA,EAAS,qBAAA,GAAwB,OAAA,CAAQ,sBAAA;EACxD,oBAAA,CAAqB,OAAA,EAAS,wBAAA,GAA2B,OAAA,CAAQ,yBAAA;EACjE,4BAAA,CAA6B,OAAA;IAAW,MAAA;EAAA,IAAmB,OAAA,CAAQ,8BAAA;EAEnE,kBAAA,CAAmB,OAAA,GAAU,yBAAA,GAA4B,OAAA,CAAQ,wBAAA;EACjE,gBAAA,CAAiB,eAAA,WAA0B,OAAA,CAAQ,kBAAA;EACnD,uBAAA,CAAwB,eAAA,UAAyB,OAAA,GAAU,8BAAA,GAAiC,OAAA,CAAQ,6BAAA;EACpG,2BAAA,CAA4B,eAAA,UAAyB,OAAA,WAAkB,OAAA,CAAQ,wCAAA;EAC/E,sBAAA,CAAuB,eAAA,UAAyB,OAAA;IAAY,MAAA;IAAiB,KAAA;EAAA,IAAmB,OAAA,CAAQ,4BAAA;EAGxG,gBAAA,CAAiB,OAAA,GAAU,sBAAA,GAAyB,OAAA,CAAQ,qBAAA;EAC5D,cAAA,CAAe,EAAA,WAAa,OAAA,CAAQ,gBAAA;EACpC,iBAAA,CAAkB,EAAA,UAAY,OAAA,EAAS,wBAAA,GAA2B,OAAA,CAAQ,gBAAA;EAC1E,gBAAA,CAAiB,EAAA,WAAa,OAAA,CAAQ,gBAAA;EACtC,kBAAA,CAAmB,EAAA,WAAa,OAAA,CAAQ,gBAAA;EACxC,iBAAA,CAAkB,EAAA,WAAa,OAAA,CAAQ,gBAAA;AAAA,IAEvC,cAAA,CAAe,aAAA,EAAe,SAAA;;KAGtB,wBAAA;EAAA,8DAIR,OAAA,EAAS,+BAAA,CAAgC,aAAA,EAAe,SAAA,IAAa,aAAA,CAAc,aAAA,EAAe,SAAA;EAAA,KAChG,OAAA,EAAS,+BAAA,oBAAmD,aAAA;AAAA;AAAA,KAEtD,kCAAA,4DAA8F,+BAAA,CAAgC,aAAA,EAAe,SAAA;AAAA,KAC7I,gBAAA,+EAA+F,aAAA,CAAc,aAAA,EAAe,SAAA;AAAA,KAC5H,2BAAA,GAA8B,wBAAA;AAAA,cAC7B,gBAAA,EAAkB,2BAAA;;cAElB,aAAA,EAAe,wBAAA"}

package/dist/lib/hexclave-app/apps/interfaces/admin-app.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-app.js","names":["_HexclaveAdminAppImpl"],"sources":["../../../../../src/lib/hexclave-app/apps/interfaces/admin-app.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport type { AnalyticsClickmapOptions, AnalyticsClickmapResponse, AnalyticsClickmapTokenResponse } from \"@hexclave/shared/dist/interface/admin-metrics\";\nimport { AnalyticsQueryOptions, AnalyticsQueryResponse } from \"@hexclave/shared/dist/interface/crud/analytics\";\nimport type { AdminGetSessionReplayChunkEventsResponse, AdminGetSessionReplayAllEventsResponse } from \"@hexclave/shared/dist/interface/crud/session-replays\";\nimport type { Transaction, TransactionType } from \"@hexclave/shared/dist/interface/crud/transactions\";\nimport { InternalSession } from \"@hexclave/shared/dist/sessions\";\nimport type { MoneyAmount } from \"@hexclave/shared/dist/utils/currency-constants\";\nimport { Result } from \"@hexclave/shared/dist/utils/results\";\nimport { AsyncStoreProperty, EmailConfig } from \"../../common\";\nimport { AdminEmailOutbox, AdminSentEmail } from \"../../email\";\nimport { InternalApiKey, InternalApiKeyCreateOptions, InternalApiKeyFirstView } from \"../../internal-api-keys\";\nimport { AdminProjectPermission, AdminProjectPermissionDefinition, AdminProjectPermissionDefinitionCreateOptions, AdminProjectPermissionDefinitionUpdateOptions, AdminTeamPermission, AdminTeamPermissionDefinition, AdminTeamPermissionDefinitionCreateOptions, AdminTeamPermissionDefinitionUpdateOptions } from \"../../permissions\";\nimport { AdminProject } from \"../../projects\";\nimport { _HexclaveAdminAppImpl } from \"../implementations\";\nimport { StackServerApp, StackServerAppConstructorOptions } from \"./server-app\";\n\nexport type EmailOutboxListOptions = {\n  status?: string,\n  simpleStatus?: string,\n  limit?: number,\n  cursor?: string,\n};\n\nexport type EmailOutboxListResult = {\n  items: AdminEmailOutbox[],\n  nextCursor: string | null,\n};\n\nexport type EmailOutboxUpdateOptions = {\n  isPaused?: boolean,\n  scheduledAtMillis?: number,\n  cancel?: boolean,\n  tsxSource?: string,\n  themeId?: string | null,\n};\n\nexport type ManagedEmailProviderSetupResult = {\n  domainId: string,\n  subdomain: string,\n  senderLocalPart: string,\n  nameServerRecords: string[],\n  status: ManagedEmailProviderStatus[\"status\"],\n};\n\nexport type ManagedEmailProviderStatus = {\n  status: \"pending_dns\" | \"pending_verification\" | \"verified\" | \"applied\" | \"failed\",\n};\n\nexport type ManagedEmailProviderListItem = {\n  domainId: string,\n  subdomain: string,\n  senderLocalPart: string,\n  status: ManagedEmailProviderStatus[\"status\"],\n  nameServerRecords: string[],\n};\n\nimport type { AdminSessionReplay, ListSessionReplayChunksOptions, ListSessionReplayChunksResult, ListSessionReplaysOptions, ListSessionReplaysResult, SessionReplayAllEventsResult } from \"../../session-replays\";\nexport type { AdminSessionReplay, AdminSessionReplayChunk, ListSessionReplaysOptions, ListSessionReplaysResult, ListSessionReplayChunksOptions, ListSessionReplayChunksResult, SessionReplayAllEventsResult } from \"../../session-replays\";\n\n\n/** @deprecated Use `HexclaveAdminAppConstructorOptions` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */\nexport type StackAdminAppConstructorOptions<HasTokenStore extends boolean, ProjectId extends string> = (\n  & StackServerAppConstructorOptions<HasTokenStore, ProjectId>\n  & {\n    superSecretAdminKey?: string,\n    projectOwnerSession?: InternalSession | (() => Promise<string | null>),\n  }\n);\n\n\n/** @deprecated Use `HexclaveAdminApp` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */\nexport type StackAdminApp<HasTokenStore extends boolean = boolean, ProjectId extends string = string> = (\n  & AsyncStoreProperty<\"project\", [], AdminProject, false>\n  & AsyncStoreProperty<\"internalApiKeys\", [], InternalApiKey[], true>\n  & AsyncStoreProperty<\"teamPermissionDefinitions\", [], AdminTeamPermissionDefinition[], true>\n  & AsyncStoreProperty<\"projectPermissionDefinitions\", [], AdminProjectPermissionDefinition[], true>\n  & AsyncStoreProperty<\"emailThemes\", [], { id: string, displayName: string }[], true>\n  & AsyncStoreProperty<\"emailPreview\", [{ themeId?: string | null | false, themeTsxSource?: string, templateId?: string, templateTsxSource?: string }], string, false>\n  & AsyncStoreProperty<\"emailTemplates\", [], { id: string, displayName: string, themeId?: string, tsxSource: string }[], true>\n  & AsyncStoreProperty<\"emailDrafts\", [], { id: string, displayName: string, themeId: string | undefined | false, tsxSource: string, sentAt: Date | null }[], true>\n  & AsyncStoreProperty<\"stripeAccountInfo\", [], { account_id: string, charges_enabled: boolean, details_submitted: boolean, payouts_enabled: boolean } | null, false>\n  & AsyncStoreProperty<\n    \"transactions\",\n    [{\n      cursor?: string,\n      limit?: number,\n      type?: TransactionType,\n      customerType?: 'user' | 'team' | 'custom',\n      customerId?: string,\n    }],\n    { transactions: Transaction[], nextCursor: string | null },\n    true\n  >\n  & {\n    createInternalApiKey(options: InternalApiKeyCreateOptions): Promise<InternalApiKeyFirstView>,\n\n    createTeamPermissionDefinition(data: AdminTeamPermissionDefinitionCreateOptions): Promise<AdminTeamPermission>,\n    updateTeamPermissionDefinition(permissionId: string, data: AdminTeamPermissionDefinitionUpdateOptions): Promise<void>,\n    deleteTeamPermissionDefinition(permissionId: string): Promise<void>,\n    /**\n     * @param options.query Free-text search; matches against permission ID and description.\n     */\n    listTeamPermissionDefinitionsPaginated(options: { limit: number, cursor?: string, query?: string }): Promise<{ items: AdminTeamPermissionDefinition[], nextCursor: string | null }>,\n\n    createProjectPermissionDefinition(data: AdminProjectPermissionDefinitionCreateOptions): Promise<AdminProjectPermission>,\n    updateProjectPermissionDefinition(permissionId: string, data: AdminProjectPermissionDefinitionUpdateOptions): Promise<void>,\n    deleteProjectPermissionDefinition(permissionId: string): Promise<void>,\n\n\n    sendTestEmail(options: {\n      recipientEmail: string,\n      emailConfig: EmailConfig,\n    }): Promise<Result<undefined, { errorMessage: string }>>,\n\n    sendTestWebhook(options: { endpointId: string }): Promise<Result<undefined, { errorMessage: string }>>,\n\n    sendSignInInvitationEmail(email: string, callbackUrl: string): Promise<void>,\n\n    listSentEmails(): Promise<AdminSentEmail[]>,\n    setupManagedEmailProvider(options: { subdomain: string, senderLocalPart: string }): Promise<ManagedEmailProviderSetupResult>,\n    checkManagedEmailStatus(options: { domainId: string, subdomain: string, senderLocalPart: string }): Promise<ManagedEmailProviderStatus>,\n    listManagedEmailDomains(): Promise<ManagedEmailProviderListItem[]>,\n    applyManagedEmailProvider(options: { domainId: string }): Promise<{ status: \"applied\" }>,\n    deleteManagedEmailDomain(options: { resendDomainId: string }): Promise<{ status: \"deleted\" }>,\n\n    createEmailTheme(displayName: string): Promise<{ id: string }>,\n    updateEmailTheme(id: string, tsxSource: string): Promise<void>,\n    deleteEmailTheme(id: string): Promise<void>,\n    saveChatMessage(threadId: string, message: any): Promise<void>,\n    listChatMessages(threadId: string): Promise<{ messages: Array<any> }>,\n    rewriteTemplateSourceWithAI(templateTsxSource: string): Promise<{ tsxSource: string }>,\n    updateEmailTemplate(id: string, tsxSource: string, themeId: string | null | false): Promise<{ renderedHtml: string }>,\n    createEmailTemplate(displayName: string): Promise<{ id: string }>,\n    deleteEmailTemplate(id: string): Promise<void>,\n\n    setupPayments(): Promise<{ url: string }>,\n    createStripeWidgetAccountSession(): Promise<{ client_secret: string }>,\n    getPaymentMethodConfigs(): Promise<{ configId: string, methods: Array<{ id: string, name: string, enabled: boolean, available: boolean, overridable: boolean }> } | null>,\n    updatePaymentMethodConfigs(configId: string, updates: Record<string, 'on' | 'off'>): Promise<void>,\n    createEmailDraft(options: { displayName: string, themeId?: string | undefined | false, tsxSource?: string }): Promise<{ id: string }>,\n    updateEmailDraft(id: string, data: { displayName?: string, themeId?: string | undefined | false, tsxSource?: string }): Promise<void>,\n    deleteEmailDraft(id: string): Promise<void>,\n    refreshEmailDrafts(): Promise<void>,\n    createItemQuantityChange(options: (\n      { userId: string, itemId: string, quantity: number, expiresAt?: string, description?: string } |\n      { teamId: string, itemId: string, quantity: number, expiresAt?: string, description?: string } |\n      { customCustomerId: string, itemId: string, quantity: number, expiresAt?: string, description?: string }\n    )): Promise<void>,\n    refundTransaction(options: {\n      type: \"subscription\" | \"one-time-purchase\",\n      id: string,\n      invoiceId?: string,\n      amountUsd: MoneyAmount,\n      endAction?: \"now\" | \"at-period-end\",\n    }): Promise<{ refundTransactionId: string }>,\n    queryAnalytics(options: AnalyticsQueryOptions): Promise<AnalyticsQueryResponse>,\n    getAnalyticsClickmap(options: AnalyticsClickmapOptions): Promise<AnalyticsClickmapResponse>,\n    createAnalyticsClickmapToken(options: { origin: string }): Promise<AnalyticsClickmapTokenResponse>,\n\n    listSessionReplays(options?: ListSessionReplaysOptions): Promise<ListSessionReplaysResult>,\n    getSessionReplay(sessionReplayId: string): Promise<AdminSessionReplay>,\n    listSessionReplayChunks(sessionReplayId: string, options?: ListSessionReplayChunksOptions): Promise<ListSessionReplayChunksResult>,\n    getSessionReplayChunkEvents(sessionReplayId: string, chunkId: string): Promise<AdminGetSessionReplayChunkEventsResponse>,\n    getSessionReplayEvents(sessionReplayId: string, options?: { offset?: number, limit?: number }): Promise<SessionReplayAllEventsResult>,\n\n    // Email Outbox methods\n    listOutboxEmails(options?: EmailOutboxListOptions): Promise<EmailOutboxListResult>,\n    getOutboxEmail(id: string): Promise<AdminEmailOutbox>,\n    updateOutboxEmail(id: string, options: EmailOutboxUpdateOptions): Promise<AdminEmailOutbox>,\n    pauseOutboxEmail(id: string): Promise<AdminEmailOutbox>,\n    unpauseOutboxEmail(id: string): Promise<AdminEmailOutbox>,\n    cancelOutboxEmail(id: string): Promise<AdminEmailOutbox>,\n  }\n  & StackServerApp<HasTokenStore, ProjectId>\n);\n/** @deprecated Use `HexclaveAdminAppConstructor` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */\nexport type StackAdminAppConstructor = {\n  new <\n    HasTokenStore extends boolean,\n    ProjectId extends string\n  >(options: StackAdminAppConstructorOptions<HasTokenStore, ProjectId>): StackAdminApp<HasTokenStore, ProjectId>,\n  new(options: StackAdminAppConstructorOptions<boolean, string>): StackAdminApp<boolean, string>,\n};\nexport type HexclaveAdminAppConstructorOptions<HasTokenStore extends boolean, ProjectId extends string> = StackAdminAppConstructorOptions<HasTokenStore, ProjectId>;\nexport type HexclaveAdminApp<HasTokenStore extends boolean = boolean, ProjectId extends string = string> = StackAdminApp<HasTokenStore, ProjectId>;\nexport type HexclaveAdminAppConstructor = StackAdminAppConstructor;\nexport const HexclaveAdminApp: HexclaveAdminAppConstructor = _HexclaveAdminAppImpl;\n/** @deprecated Use `HexclaveAdminApp` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */\nexport const StackAdminApp: StackAdminAppConstructor = HexclaveAdminApp;\n"],"mappings":";;;;;AA6LA,MAAa,mBAAgDA;;AAE7D,MAAa,gBAA0C"}
+{"version":3,"file":"admin-app.js","names":["_HexclaveAdminAppImpl"],"sources":["../../../../../src/lib/hexclave-app/apps/interfaces/admin-app.ts"],"sourcesContent":["\n//===========================================\n// THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template\n//===========================================\nimport type { AnalyticsClickmapOptions, AnalyticsClickmapResponse, AnalyticsClickmapTokenResponse } from \"@hexclave/shared/dist/interface/admin-metrics\";\nimport { AnalyticsQueryOptions, AnalyticsQueryResponse } from \"@hexclave/shared/dist/interface/crud/analytics\";\nimport type { AdminGetSessionReplayChunkEventsResponse, AdminGetSessionReplayAllEventsResponse } from \"@hexclave/shared/dist/interface/crud/session-replays\";\nimport type { Transaction, TransactionType } from \"@hexclave/shared/dist/interface/crud/transactions\";\nimport { InternalSession } from \"@hexclave/shared/dist/sessions\";\nimport type { MoneyAmount } from \"@hexclave/shared/dist/utils/currency-constants\";\nimport { Result } from \"@hexclave/shared/dist/utils/results\";\nimport { AsyncStoreProperty, EmailConfig } from \"../../common\";\nimport { AdminEmailOutbox, AdminSentEmail } from \"../../email\";\nimport { InternalApiKey, InternalApiKeyCreateOptions, InternalApiKeyFirstView } from \"../../internal-api-keys\";\nimport { AdminProjectPermission, AdminProjectPermissionDefinition, AdminProjectPermissionDefinitionCreateOptions, AdminProjectPermissionDefinitionUpdateOptions, AdminTeamPermission, AdminTeamPermissionDefinition, AdminTeamPermissionDefinitionCreateOptions, AdminTeamPermissionDefinitionUpdateOptions } from \"../../permissions\";\nimport { AdminProject } from \"../../projects\";\nimport { _HexclaveAdminAppImpl } from \"../implementations\";\nimport { StackServerApp, StackServerAppConstructorOptions } from \"./server-app\";\n\nexport type EmailOutboxListOptions = {\n  status?: string,\n  simpleStatus?: string,\n  userId?: string,\n  limit?: number,\n  cursor?: string,\n};\n\nexport type EmailOutboxListResult = {\n  items: AdminEmailOutbox[],\n  nextCursor: string | null,\n};\n\nexport type EmailOutboxUpdateOptions = {\n  isPaused?: boolean,\n  scheduledAtMillis?: number,\n  cancel?: boolean,\n  tsxSource?: string,\n  themeId?: string | null,\n};\n\nexport type ManagedEmailProviderSetupResult = {\n  domainId: string,\n  subdomain: string,\n  senderLocalPart: string,\n  nameServerRecords: string[],\n  status: ManagedEmailProviderStatus[\"status\"],\n};\n\nexport type ManagedEmailProviderStatus = {\n  status: \"pending_dns\" | \"pending_verification\" | \"verified\" | \"applied\" | \"failed\",\n};\n\nexport type ManagedEmailProviderListItem = {\n  domainId: string,\n  subdomain: string,\n  senderLocalPart: string,\n  status: ManagedEmailProviderStatus[\"status\"],\n  nameServerRecords: string[],\n};\n\nimport type { AdminSessionReplay, ListSessionReplayChunksOptions, ListSessionReplayChunksResult, ListSessionReplaysOptions, ListSessionReplaysResult, SessionReplayAllEventsResult } from \"../../session-replays\";\nexport type { AdminSessionReplay, AdminSessionReplayChunk, ListSessionReplaysOptions, ListSessionReplaysResult, ListSessionReplayChunksOptions, ListSessionReplayChunksResult, SessionReplayAllEventsResult } from \"../../session-replays\";\n\n\n/** @deprecated Use `HexclaveAdminAppConstructorOptions` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */\nexport type StackAdminAppConstructorOptions<HasTokenStore extends boolean, ProjectId extends string> = (\n  & StackServerAppConstructorOptions<HasTokenStore, ProjectId>\n  & {\n    superSecretAdminKey?: string,\n    projectOwnerSession?: InternalSession | (() => Promise<string | null>),\n  }\n);\n\n\n/** @deprecated Use `HexclaveAdminApp` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */\nexport type StackAdminApp<HasTokenStore extends boolean = boolean, ProjectId extends string = string> = (\n  & AsyncStoreProperty<\"project\", [], AdminProject, false>\n  & AsyncStoreProperty<\"internalApiKeys\", [], InternalApiKey[], true>\n  & AsyncStoreProperty<\"teamPermissionDefinitions\", [], AdminTeamPermissionDefinition[], true>\n  & AsyncStoreProperty<\"projectPermissionDefinitions\", [], AdminProjectPermissionDefinition[], true>\n  & AsyncStoreProperty<\"emailThemes\", [], { id: string, displayName: string }[], true>\n  & AsyncStoreProperty<\"emailPreview\", [{ themeId?: string | null | false, themeTsxSource?: string, templateId?: string, templateTsxSource?: string }], string, false>\n  & AsyncStoreProperty<\"emailTemplates\", [], { id: string, displayName: string, themeId?: string, tsxSource: string }[], true>\n  & AsyncStoreProperty<\"emailDrafts\", [], { id: string, displayName: string, themeId: string | undefined | false, tsxSource: string, sentAt: Date | null }[], true>\n  & AsyncStoreProperty<\"stripeAccountInfo\", [], { account_id: string, charges_enabled: boolean, details_submitted: boolean, payouts_enabled: boolean } | null, false>\n  & AsyncStoreProperty<\n    \"transactions\",\n    [{\n      cursor?: string,\n      limit?: number,\n      type?: TransactionType,\n      customerType?: 'user' | 'team' | 'custom',\n      customerId?: string,\n    }],\n    { transactions: Transaction[], nextCursor: string | null },\n    true\n  >\n  & {\n    createInternalApiKey(options: InternalApiKeyCreateOptions): Promise<InternalApiKeyFirstView>,\n\n    createTeamPermissionDefinition(data: AdminTeamPermissionDefinitionCreateOptions): Promise<AdminTeamPermission>,\n    updateTeamPermissionDefinition(permissionId: string, data: AdminTeamPermissionDefinitionUpdateOptions): Promise<void>,\n    deleteTeamPermissionDefinition(permissionId: string): Promise<void>,\n    /**\n     * @param options.query Free-text search; matches against permission ID and description.\n     */\n    listTeamPermissionDefinitionsPaginated(options: { limit: number, cursor?: string, query?: string }): Promise<{ items: AdminTeamPermissionDefinition[], nextCursor: string | null }>,\n\n    createProjectPermissionDefinition(data: AdminProjectPermissionDefinitionCreateOptions): Promise<AdminProjectPermission>,\n    updateProjectPermissionDefinition(permissionId: string, data: AdminProjectPermissionDefinitionUpdateOptions): Promise<void>,\n    deleteProjectPermissionDefinition(permissionId: string): Promise<void>,\n\n\n    sendTestEmail(options: {\n      recipientEmail: string,\n      emailConfig: EmailConfig,\n    }): Promise<Result<undefined, { errorMessage: string }>>,\n\n    sendTestWebhook(options: { endpointId: string }): Promise<Result<undefined, { errorMessage: string }>>,\n\n    sendSignInInvitationEmail(email: string, callbackUrl: string): Promise<void>,\n\n    listSentEmails(): Promise<AdminSentEmail[]>,\n    setupManagedEmailProvider(options: { subdomain: string, senderLocalPart: string }): Promise<ManagedEmailProviderSetupResult>,\n    checkManagedEmailStatus(options: { domainId: string, subdomain: string, senderLocalPart: string }): Promise<ManagedEmailProviderStatus>,\n    listManagedEmailDomains(): Promise<ManagedEmailProviderListItem[]>,\n    applyManagedEmailProvider(options: { domainId: string }): Promise<{ status: \"applied\" }>,\n    deleteManagedEmailDomain(options: { resendDomainId: string }): Promise<{ status: \"deleted\" }>,\n\n    createEmailTheme(displayName: string): Promise<{ id: string }>,\n    updateEmailTheme(id: string, tsxSource: string): Promise<void>,\n    deleteEmailTheme(id: string): Promise<void>,\n    saveChatMessage(threadId: string, message: any): Promise<void>,\n    listChatMessages(threadId: string): Promise<{ messages: Array<any> }>,\n    rewriteTemplateSourceWithAI(templateTsxSource: string): Promise<{ tsxSource: string }>,\n    updateEmailTemplate(id: string, tsxSource: string, themeId: string | null | false): Promise<{ renderedHtml: string }>,\n    createEmailTemplate(displayName: string): Promise<{ id: string }>,\n    deleteEmailTemplate(id: string): Promise<void>,\n\n    setupPayments(): Promise<{ url: string }>,\n    createStripeWidgetAccountSession(): Promise<{ client_secret: string }>,\n    getPaymentMethodConfigs(): Promise<{ configId: string, methods: Array<{ id: string, name: string, enabled: boolean, available: boolean, overridable: boolean }> } | null>,\n    updatePaymentMethodConfigs(configId: string, updates: Record<string, 'on' | 'off'>): Promise<void>,\n    createEmailDraft(options: { displayName: string, themeId?: string | undefined | false, tsxSource?: string }): Promise<{ id: string }>,\n    updateEmailDraft(id: string, data: { displayName?: string, themeId?: string | undefined | false, tsxSource?: string }): Promise<void>,\n    deleteEmailDraft(id: string): Promise<void>,\n    refreshEmailDrafts(): Promise<void>,\n    createItemQuantityChange(options: (\n      { userId: string, itemId: string, quantity: number, expiresAt?: string, description?: string } |\n      { teamId: string, itemId: string, quantity: number, expiresAt?: string, description?: string } |\n      { customCustomerId: string, itemId: string, quantity: number, expiresAt?: string, description?: string }\n    )): Promise<void>,\n    refundTransaction(options: {\n      type: \"subscription\" | \"one-time-purchase\",\n      id: string,\n      invoiceId?: string,\n      amountUsd: MoneyAmount,\n      endAction?: \"now\" | \"at-period-end\",\n    }): Promise<{ refundTransactionId: string }>,\n    queryAnalytics(options: AnalyticsQueryOptions): Promise<AnalyticsQueryResponse>,\n    getAnalyticsClickmap(options: AnalyticsClickmapOptions): Promise<AnalyticsClickmapResponse>,\n    createAnalyticsClickmapToken(options: { origin: string }): Promise<AnalyticsClickmapTokenResponse>,\n\n    listSessionReplays(options?: ListSessionReplaysOptions): Promise<ListSessionReplaysResult>,\n    getSessionReplay(sessionReplayId: string): Promise<AdminSessionReplay>,\n    listSessionReplayChunks(sessionReplayId: string, options?: ListSessionReplayChunksOptions): Promise<ListSessionReplayChunksResult>,\n    getSessionReplayChunkEvents(sessionReplayId: string, chunkId: string): Promise<AdminGetSessionReplayChunkEventsResponse>,\n    getSessionReplayEvents(sessionReplayId: string, options?: { offset?: number, limit?: number }): Promise<SessionReplayAllEventsResult>,\n\n    // Email Outbox methods\n    listOutboxEmails(options?: EmailOutboxListOptions): Promise<EmailOutboxListResult>,\n    getOutboxEmail(id: string): Promise<AdminEmailOutbox>,\n    updateOutboxEmail(id: string, options: EmailOutboxUpdateOptions): Promise<AdminEmailOutbox>,\n    pauseOutboxEmail(id: string): Promise<AdminEmailOutbox>,\n    unpauseOutboxEmail(id: string): Promise<AdminEmailOutbox>,\n    cancelOutboxEmail(id: string): Promise<AdminEmailOutbox>,\n  }\n  & StackServerApp<HasTokenStore, ProjectId>\n);\n/** @deprecated Use `HexclaveAdminAppConstructor` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */\nexport type StackAdminAppConstructor = {\n  new <\n    HasTokenStore extends boolean,\n    ProjectId extends string\n  >(options: StackAdminAppConstructorOptions<HasTokenStore, ProjectId>): StackAdminApp<HasTokenStore, ProjectId>,\n  new(options: StackAdminAppConstructorOptions<boolean, string>): StackAdminApp<boolean, string>,\n};\nexport type HexclaveAdminAppConstructorOptions<HasTokenStore extends boolean, ProjectId extends string> = StackAdminAppConstructorOptions<HasTokenStore, ProjectId>;\nexport type HexclaveAdminApp<HasTokenStore extends boolean = boolean, ProjectId extends string = string> = StackAdminApp<HasTokenStore, ProjectId>;\nexport type HexclaveAdminAppConstructor = StackAdminAppConstructor;\nexport const HexclaveAdminApp: HexclaveAdminAppConstructor = _HexclaveAdminAppImpl;\n/** @deprecated Use `HexclaveAdminApp` from the `@hexclave/*` package instead — same symbol, new brand name. See https://docs.hexclave.com/migration. */\nexport const StackAdminApp: StackAdminAppConstructor = HexclaveAdminApp;\n"],"mappings":";;;;;AA8LA,MAAa,mBAAgDA;;AAE7D,MAAa,gBAA0C"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template (FOR package.json FILES, PLEASE EDIT package-template.json)",
   "name": "@hexclave/js",
-  "version": "1.0.20",
+  "version": "1.0.22",
   "repository": "https://github.com/hexclave/hexclave",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -66,7 +66,7 @@
     "rrweb": "^1.1.3",
     "tsx": "^4.21.0",
     "yup": "^1.7.1",
-    "@hexclave/shared": "1.0.20"
+    "@hexclave/shared": "1.0.22"
   },
   "devDependencies": {
     "@quetzallabs/i18n": "^0.1.19",

package/src/lib/auth.test.ts

@@ -4,9 +4,9 @@
 //===========================================
 // @vitest-environment jsdom
 
-import { HexclaveClientInterface } from "@hexclave/shared";
+import { HexclaveClientInterface, KnownErrors } from "@hexclave/shared";
 import { describe, expect, it, vi } from "vitest";
-import { getNewOAuthProviderOrScopeUrl } from "./auth";
+import { callOAuthCallback, getNewOAuthProviderOrScopeUrl } from "./auth";
 
 vi.mock("./cookie", async (importOriginal) => {
   const actual = await importOriginal<typeof import("./cookie")>();
@@ -19,18 +19,22 @@ vi.mock("./cookie", async (importOriginal) => {
   };
 });
 
+function createTestInterface() {
+  return new HexclaveClientInterface({
+    clientVersion: "test",
+    getBaseUrl: () => "https://api.example.com",
+    getApiUrls: () => ["https://api.example.com"],
+    extraRequestHeaders: {},
+    projectId: "00000000-0000-4000-8000-000000000000",
+    publishableClientKey: "pck_test",
+  });
+}
+
 describe("getNewOAuthProviderOrScopeUrl", () => {
   it("returns the OAuth URL without performing navigation", async () => {
     window.history.replaceState({}, "", "/account?after_auth_return_to=%2Fsettings");
 
-    const iface = new HexclaveClientInterface({
-      clientVersion: "test",
-      getBaseUrl: () => "https://api.example.com",
-      getApiUrls: () => ["https://api.example.com"],
-      extraRequestHeaders: {},
-      projectId: "00000000-0000-4000-8000-000000000000",
-      publishableClientKey: "pck_test",
-    });
+    const iface = createTestInterface();
     const session = iface.createSession({ refreshToken: null, accessToken: null });
 
     const location = await getNewOAuthProviderOrScopeUrl(
@@ -65,3 +69,21 @@ describe("getNewOAuthProviderOrScopeUrl", () => {
     `);
   });
 });
+
+describe("callOAuthCallback", () => {
+  it("turns provider access denial callback params into a known error", async () => {
+    window.history.replaceState({}, "", "/handler/oauth-callback?error=access_denied&error_description=User+cancelled");
+
+    await expect(callOAuthCallback(createTestInterface(), "/handler/oauth-callback"))
+      .rejects.toSatisfy((error: unknown) => KnownErrors.OAuthProviderAccessDenied.isInstance(error));
+    expect(window.location.href).toBe("http://localhost:3000/handler/oauth-callback");
+  });
+
+  it("turns generic provider error callback params into a known error", async () => {
+    window.history.replaceState({}, "", "/handler/oauth-callback?error=server_error&error_description=Provider+failed");
+
+    await expect(callOAuthCallback(createTestInterface(), "/handler/oauth-callback"))
+      .rejects.toSatisfy((error: unknown) => KnownErrors.OAuthProviderTemporarilyUnavailable.isInstance(error));
+    expect(window.location.href).toBe("http://localhost:3000/handler/oauth-callback");
+  });
+});

package/src/lib/auth.ts

@@ -2,7 +2,7 @@
 //===========================================
 // THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template
 //===========================================
-import { KnownError, HexclaveClientInterface } from "@hexclave/shared";
+import { KnownError, KnownErrors, HexclaveClientInterface } from "@hexclave/shared";
 import { InternalSession } from "@hexclave/shared/dist/sessions";
 import { HexclaveAssertionError, throwErr } from "@hexclave/shared/dist/utils/errors";
 import { Result } from "@hexclave/shared/dist/utils/results";
@@ -50,10 +50,39 @@ type OAuthCallbackConsumptionResult =
     error: KnownError,
   };
 
+const oauthErrorParams = ["error", "error_description", "errorCode", "message", "details"] as const;
+
+function removeOAuthErrorParamsFromHistory(originalUrl: URL): void {
+  const newUrl = new URL(originalUrl);
+  for (const param of oauthErrorParams) {
+    newUrl.searchParams.delete(param);
+  }
+  window.history.replaceState({}, "", newUrl.toString());
+}
+
+function getProviderOAuthErrorFromUrl(originalUrl: URL): KnownError | null {
+  const providerError = originalUrl.searchParams.get("error");
+  const providerErrorDescription = originalUrl.searchParams.get("error_description");
+  if (providerError == null && providerErrorDescription == null) {
+    return null;
+  }
+
+  switch (providerError) {
+    case "access_denied":
+    case "consent_required": {
+      return new KnownErrors.OAuthProviderAccessDenied();
+    }
+    case "server_error":
+    case "temporarily_unavailable":
+    default: {
+      return new KnownErrors.OAuthProviderTemporarilyUnavailable();
+    }
+  }
+}
+
 function consumeOAuthCallbackQueryParams(options?: {
   dontWarnAboutMissingQueryParams?: boolean,
 }): OAuthCallbackConsumptionResult | null {
-  const oauthErrorParams = ["error", "error_description", "errorCode", "message", "details"] as const;
   const requiredParams = ["code", "state"];
   const originalUrl = new URL(window.location.href);
   const knownErrorCode = originalUrl.searchParams.get("errorCode");
@@ -72,11 +101,7 @@ function consumeOAuthCallbackQueryParams(options?: {
       }
     }
 
-    const newUrl = new URL(originalUrl);
-    for (const param of oauthErrorParams) {
-      newUrl.searchParams.delete(param);
-    }
-    window.history.replaceState({}, "", newUrl.toString());
+    removeOAuthErrorParamsFromHistory(originalUrl);
 
     return {
       type: "known-error",
@@ -88,6 +113,15 @@ function consumeOAuthCallbackQueryParams(options?: {
     };
   }
 
+  const providerOAuthError = getProviderOAuthErrorFromUrl(originalUrl);
+  if (providerOAuthError != null && !requiredParams.every(param => originalUrl.searchParams.has(param))) {
+    removeOAuthErrorParamsFromHistory(originalUrl);
+    return {
+      type: "known-error",
+      error: providerOAuthError,
+    };
+  }
+
   for (const param of requiredParams) {
     if (!originalUrl.searchParams.has(param)) {
       if (!options?.dontWarnAboutMissingQueryParams) {

package/src/lib/hexclave-app/apps/implementations/admin-app-impl.ts

@@ -986,10 +986,11 @@ export class _HexclaveAdminAppImplIncomplete<HasTokenStore extends boolean, Proj
     return result as AdminEmailOutbox;
   }
 
-  async listOutboxEmails(options?: { status?: string, simpleStatus?: string, limit?: number, cursor?: string }): Promise<{ items: AdminEmailOutbox[], nextCursor: string | null }> {
+  async listOutboxEmails(options?: { status?: string, simpleStatus?: string, userId?: string, limit?: number, cursor?: string }): Promise<{ items: AdminEmailOutbox[], nextCursor: string | null }> {
     const response = await this._interface.listOutboxEmails({
       status: options?.status,
       simple_status: options?.simpleStatus,
+      user_id: options?.userId,
       limit: options?.limit,
       cursor: options?.cursor,
     });

package/src/lib/hexclave-app/apps/implementations/client-app-impl.cross-domain.test.ts

@@ -439,6 +439,72 @@ describe("StackClientApp cross-domain auth", () => {
     }
   });
 
+  it("redirects hosted current-page OAuth callback errors to the hosted error handler during startup", async () => {
+    const projectId = "00000000-0000-4000-8000-000000000010";
+    const previousWindow = globalThis.window;
+    const previousDocument = globalThis.document;
+    const callbackUrl = new URL("https://demo.stack-auth.com/dashboard");
+    callbackUrl.searchParams.set("errorCode", "SIGN_UP_REJECTED");
+    callbackUrl.searchParams.set("message", "Your sign up was rejected by an administrator's sign-up rule.");
+    callbackUrl.searchParams.set("details", JSON.stringify({
+      message: "Your sign up was rejected by an administrator's sign-up rule.",
+    }));
+    let currentHref = callbackUrl.toString();
+    let redirectedUrl = "";
+    const redirectSpy = vi.spyOn(StackClientApp.prototype as any, "_redirectTo").mockImplementation(async (...args: unknown[]) => {
+      const options = args[0] as { url: string | URL };
+      redirectedUrl = options.url.toString();
+    });
+
+    globalThis.document = createMockDocument();
+    globalThis.window = {
+      location: {
+        get href() {
+          return currentHref;
+        },
+        set href(value: string) {
+          currentHref = value;
+        },
+        origin: callbackUrl.origin,
+      },
+      history: {
+        replaceState: (_state: unknown, _title: string, url: string) => {
+          currentHref = new URL(url, currentHref).toString();
+        },
+      },
+      addEventListener: () => {},
+      removeEventListener: () => {},
+    } as any;
+
+    try {
+      new StackClientApp({
+        baseUrl: "http://localhost:12345",
+        projectId,
+        publishableClientKey: "stack-pk-test",
+        tokenStore: "memory",
+        redirectMethod: "window",
+        urls: {
+          default: { type: "hosted" },
+        },
+        noAutomaticPrefetch: true,
+      });
+
+      await new Promise((resolve) => setTimeout(resolve, 0));
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    } finally {
+      redirectSpy.mockRestore();
+      globalThis.window = previousWindow;
+      globalThis.document = previousDocument;
+    }
+
+    const errorUrl = new URL(redirectedUrl);
+    expect(errorUrl.origin).toBe(`https://${projectId}.built-with-stack-auth.com`);
+    expect(errorUrl.pathname).toBe("/handler/error");
+    expect(errorUrl.searchParams.get("errorCode")).toBe("SIGN_UP_REJECTED");
+    expect(errorUrl.searchParams.get("message")).toBe("Your sign up was rejected by an administrator's sign-up rule.");
+    expect(new URL(currentHref).searchParams.has("errorCode")).toBe(false);
+  });
+
   it("uses direct sign-out instead of hosted sign-out redirects when code execution is available", async () => {
     const clientApp = new StackClientApp({
       baseUrl: "http://localhost:12345",

package/src/lib/hexclave-app/apps/implementations/client-app-impl.ts

@@ -3,7 +3,7 @@
 // THIS FILE IS AUTO-GENERATED FROM TEMPLATE. DO NOT EDIT IT DIRECTLY UNLESS YOU ALSO EDIT THE CORRESPONDING FILE IN packages/template
 //===========================================
 import { WebAuthnError, startAuthentication, startRegistration } from "@simplewebauthn/browser";
-import { KnownErrors, HexclaveClientInterface } from "@hexclave/shared";
+import { KnownError, KnownErrors, HexclaveClientInterface } from "@hexclave/shared";
 import type { RequestListener } from "@hexclave/shared/dist/interface/client-interface";
 import { ContactChannelsCrud } from "@hexclave/shared/dist/interface/crud/contact-channels";
 import { CurrentUserCrud } from "@hexclave/shared/dist/interface/crud/current-user";
@@ -685,11 +685,11 @@ export class _HexclaveClientAppImplIncomplete<HasTokenStore extends boolean, Pro
     if (
       isBrowserLike()
       && (this._isOAuthCallbackUrlHosted() || this._currentUrlLooksLikeNestedCrossDomainOAuthCallback())
-      && this._currentUrlLooksLikeHexclaveOAuthCallback()
+      && (this._currentUrlLooksLikeHexclaveOAuthCallback() || this._currentUrlLooksLikeOAuthCallbackError())
     ) {
       this._trackPendingAuthResolution(async () => {
         if (isBrowserLike()) {
-          await this.callOAuthCallback({ dontWarnAboutMissingQueryParams: true });
+          await this._handleHostedOAuthCallbackDuringStartup();
         }
       });
     }
@@ -779,6 +779,22 @@ export class _HexclaveClientAppImplIncomplete<HasTokenStore extends boolean, Pro
       currentUrl.searchParams.has("code") && currentUrl.searchParams.has("state")
     ) || (
       currentUrl.searchParams.has("errorCode") && currentUrl.searchParams.has("message")
+    ) || (
+      this._currentUrlLooksLikeOAuthCallbackError()
+    );
+  }
+
+  protected _currentUrlLooksLikeOAuthCallbackError(): boolean {
+    if (typeof window === "undefined") {
+      return false;
+    }
+    const currentUrl = new URL(window.location.href);
+    if (currentUrl.searchParams.has("errorCode") && currentUrl.searchParams.has("message")) {
+      return true;
+    }
+    return (
+      (currentUrl.searchParams.has("error") || currentUrl.searchParams.has("error_description"))
+      && !(currentUrl.searchParams.has("code") && currentUrl.searchParams.has("state"))
     );
   }
 
@@ -820,6 +836,26 @@ export class _HexclaveClientAppImplIncomplete<HasTokenStore extends boolean, Pro
     return currentUrl.toString();
   }
 
+  protected async _redirectToOAuthCallbackError(error: KnownError): Promise<void> {
+    const errorUrl = new URL(this._getUrls().error, window.location.href);
+    errorUrl.searchParams.set("errorCode", error.errorCode);
+    errorUrl.searchParams.set("message", error.message);
+    errorUrl.searchParams.set("details", JSON.stringify(error.details ?? {}));
+    await this._redirectIfTrusted(errorUrl.toString(), { replace: true });
+  }
+
+  protected async _handleHostedOAuthCallbackDuringStartup(): Promise<void> {
+    try {
+      await this.callOAuthCallback({ dontWarnAboutMissingQueryParams: true });
+    } catch (error) {
+      if (KnownError.isKnownError(error)) {
+        await this._redirectToOAuthCallbackError(error);
+        return;
+      }
+      throw error;
+    }
+  }
+
   protected async _fetchCurrentRefreshTokenIdIfSignedIn(options?: {
     awaitPendingAuthResolutions?: boolean,
     overrideTokenStoreInit?: TokenStoreInit,

package/src/lib/hexclave-app/apps/implementations/event-tracker.test.ts

@@ -4,6 +4,7 @@
 //===========================================
 // @vitest-environment jsdom
 
+import { KnownErrors } from "@hexclave/shared/dist/known-errors";
 import { Result } from "@hexclave/shared/dist/utils/results";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { EventTracker } from "./event-tracker";
@@ -390,7 +391,7 @@ describe("EventTracker", () => {
     }
   });
 
-  it("silently disables when server responds with ANALYTICS_NOT_ENABLED", async () => {
+  it("silently disables when client interface returns ANALYTICS_NOT_ENABLED as an error", async () => {
     vi.useFakeTimers();
     document.body.innerHTML = "<button>Click me</button>";
 
@@ -400,28 +401,19 @@ describe("EventTracker", () => {
       projectId: "internal",
       sendBatch: async (body) => {
         sentBodies.push(body);
-        return Result.ok(new Response(
-          JSON.stringify({ code: "ANALYTICS_NOT_ENABLED", error: "Analytics is not enabled for this project." }),
-          {
-            status: 400,
-            headers: { "x-stack-known-error": "ANALYTICS_NOT_ENABLED" },
-          },
-        ));
+        return Result.error(new KnownErrors.AnalyticsNotEnabled());
       },
     });
 
     try {
       tracker.start();
 
-      // First flush sends the initial page-view event; server rejects it.
       await advancePastFlush();
       expect(sentBodies).toHaveLength(1);
-
-      // No console.warn should have been emitted.
       expect(warnSpy).not.toHaveBeenCalled();
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+      expect((tracker as any)._flushTimer).toBeNull();
 
-      // After disabling, new events should not accumulate or trigger further
-      // flushes.
       document.querySelector("button")?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
       await advancePastFlush();
       expect(sentBodies).toHaveLength(1);

package/src/lib/hexclave-app/apps/implementations/event-tracker.ts

@@ -8,7 +8,7 @@ import { cssEscapeIdent } from "@hexclave/shared/dist/utils/dom";
 import { buildElementsChain, ELEMENTS_CHAIN_MAX_DEPTH } from "@hexclave/shared/dist/utils/elements-chain";
 import { runAsynchronously } from "@hexclave/shared/dist/utils/promises";
 import { Result } from "@hexclave/shared/dist/utils/results";
-import { generateUuid } from "./session-replay";
+import { generateUuid, isAnalyticsNotEnabledError } from "./session-replay";
 
 const FLUSH_INTERVAL_MS = 10_000;
 const MAX_EVENTS_PER_BATCH = 50;
@@ -34,6 +34,10 @@ function hasHistoryMethods(value: unknown): value is { pushState: History["pushS
   return typeof value.pushState === "function" && typeof value.replaceState === "function";
 }
 
+function getTextSnippet(textContent: string | null): string {
+  return textContent == null ? "" : textContent.trim().substring(0, 200);
+}
+
 // Pixel quantization factor for x/y/viewport in stored click events. Matches the
 // SCALE_FACTOR used by the ClickHouse clickmap_events MV — keep them in sync.
 const CLICKMAP_SCALE_FACTOR = 16;
@@ -321,7 +325,7 @@ export class EventTracker {
       event_at_ms: Date.now(),
       data: {
         tag_name: target.tagName.toLowerCase(),
-        text: target.textContent.trim().substring(0, 200),
+        text: getTextSnippet(target.textContent),
         href: this._findNearestAnchorHref(target),
         selector: this._buildSelector(target),
         elements_chain: buildElementsChain(target),
@@ -503,27 +507,28 @@ export class EventTracker {
     );
 
     if (res.status === "error") {
+      if (isAnalyticsNotEnabledError(res.error)) {
+        this._disable();
+        return;
+      }
       console.warn("EventTracker flush failed:", res.error);
       return;
     }
 
     if (!res.data.ok) {
-      // If the server tells us analytics is not enabled for this project,
-      // silently disable the tracker — no point retrying or warning the user.
-      const knownError = res.data.headers.get("x-hexclave-known-error") ?? res.data.headers.get("x-stack-known-error");
-      if (knownError === "ANALYTICS_NOT_ENABLED") {
-        this._disabled = true;
-        if (this._flushTimer !== null) {
-          clearInterval(this._flushTimer);
-          this._flushTimer = null;
-        }
-        this._teardown();
-        return;
-      }
       console.warn("EventTracker flush failed:", res.data.status, await res.data.text());
     }
   }
 
+  private _disable() {
+    this._disabled = true;
+    if (this._flushTimer !== null) {
+      clearInterval(this._flushTimer);
+      this._flushTimer = null;
+    }
+    this._teardown();
+  }
+
   private _tick() {
     if (this._cancelled) return;
     if (this._events.length > 0) {

package/src/lib/hexclave-app/apps/implementations/session-replay.test.ts

@@ -4,6 +4,7 @@
 //===========================================
 // @vitest-environment jsdom
 
+import { KnownErrors } from "@hexclave/shared/dist/known-errors";
 import { describe, expect, it, vi } from "vitest";
 import { Result } from "@hexclave/shared/dist/utils/results";
 import { analyticsOptionsFromJson, analyticsOptionsToJson, getSessionReplayOptions, SessionRecorder } from "./session-replay";
@@ -48,10 +49,9 @@ describe("analytics option JSON conversion", () => {
 });
 
 describe("SessionRecorder flush", () => {
-  it("silently disables when server responds with ANALYTICS_NOT_ENABLED", async () => {
+  it("silently disables when client interface returns ANALYTICS_NOT_ENABLED as an error", async () => {
     vi.useFakeTimers();
 
-    // Seed localStorage with a valid session so _flush doesn't fail on getOrRotateSession
     const storageKey = `hexclave:session-replay:v1:test-project`;
     localStorage.setItem(storageKey, JSON.stringify({
       session_id: "test-session",
@@ -65,13 +65,7 @@ describe("SessionRecorder flush", () => {
         projectId: "test-project",
         sendBatch: async (body) => {
           sentBodies.push(body);
-          return Result.ok(new Response(
-            JSON.stringify({ code: "ANALYTICS_NOT_ENABLED", error: "Analytics is not enabled for this project." }),
-            {
-              status: 400,
-              headers: { "x-stack-known-error": "ANALYTICS_NOT_ENABLED" },
-            },
-          ));
+          return Result.error(new KnownErrors.AnalyticsNotEnabled());
         },
       },
       {},
@@ -80,26 +74,16 @@ describe("SessionRecorder flush", () => {
     const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
 
     try {
-      // Inject an event directly into the recorder's buffer to test flush behavior
-      // without needing rrweb. We access private fields for testing purposes.
       // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
       (recorder as any)._events = [{ type: 2, timestamp: Date.now(), data: {} }];
 
-      // Manually trigger a tick (which calls _flush)
       // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call
       (recorder as any)._tick();
       await vi.advanceTimersByTimeAsync(0);
 
-      // One batch should have been sent
       expect(sentBodies).toHaveLength(1);
+      expect(warnSpy).not.toHaveBeenCalled();
 
-      // No console.warn about "SessionRecorder flush failed" should have been emitted
-      const flushWarnings = warnSpy.mock.calls.filter(
-        (args) => typeof args[0] === "string" && args[0].includes("SessionRecorder")
-      );
-      expect(flushWarnings).toHaveLength(0);
-
-      // After disabling, pushing new events and triggering another tick should not send
       // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
       (recorder as any)._events = [{ type: 3, timestamp: Date.now(), data: {} }];
       // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call